In Windows 7, the "User" column in the security event log only produces "N/A". One must go to the event description for each event to see the username. I want to review the security log with the username available in a column. So in a roundabout approach I figured I can export the log to an XML and somehow extract what I need, producing a spreadsheet with the username readily available in a column. The username is available when exporting to an XML file. It's stored in the "Data" field as 'SubjectUserName'. How do I construct a SQL statement to select XML fields? I've tested the following command just to see if it works but obviously it produces additional records I don't need as "Data" is used to store more information than just the username. LOGPARSER "SELECT Data, EventID INTO c:\temp\log_output.csv FROM log.xml" -i:XML -o:CSV Grasping at straws here: LOGPARSER "SELECT [Data].value('(/data//subjectusername/node())[1]', 'nvarchar(max)') as User, EventID INTO c:\temp\log_output.csv FROM log.xml" -i:XML -o:CSV I appreciate any help.

I would have ask here. http://social.technet.microsoft.com/Forums/en/ITCG/threads/ Thanks

I would have ask here. http://social.technet.microsoft.com/Forums/en/ITCG/threads/ Thanks

Thanks.